Troubleshooting Tip: Site-to-Site IPsec VPN intermittent connection due to phase 2 mismatch

To troubleshoot this, make sure there are enough phase 2 selectors on both local and remote sites. In addition, make sure IKE v2 is used instead of IKE v1.

Example of the problem:

In this example:

There is a site-to-site IPsec VPN intermittent connection. There are only two Phase 2 selectors, namely: Subnet A to Subnet C, and Subnet B to Subnet D. On phase 2 debugging, a phase 2 mismatch is seen in the debug log.

Solution:

Add two more phase 2 selectors, namely Subnet A to Subnet D and Subnet B to Subnet C, and change IPSec from IKE v1 to IKE v2.

Result:

On phase 2 debugging, there is no more phase 2 mismatch, and there is no more site-to-site IPsec VPN intermittent connection.

Note:

Be cautious when selecting multiple encryption and authentication algorithms in the phase 2 selectors, particularly AEAD ciphers such as AES-GCM or ChaCha20-Poly1305. IKEv1 does not define a standard for AEAD cipher support. Therefore, FortiGate does not allow AEAD ciphers in the phase 1 proposal when using IKEv1. However, configuring AEAD ciphers in the phase 2 selector with an IKEv1 tunnel may result in intermittent connection timeouts. It is recommended to use non-AEAD ciphers for the phase 2 selector.